Fix possible use-after-free in realpath_cache_clean()

[DimitryAndric]

Fix for https://bugs.php.net/bug.php?id=81068.

If ZTS is enabled, this can cause cwd_globals_ctor() to be called multiple times, each with a freshly allocated virtual_cwd_globals instance. At shutdown time however, cwd_globals_dtor() will call realpath_cache_clean(), which then possibly cleans up the same realpath_cache instance more than once. Using AddressSanitzer, this shows up as a heap use-after-free.

To avoid this, add a helper function to do the actual work on one instance of a realpath_cache, and call it both from cwd_globals_dtor() and realpath_cache_clean(). The former uses the virtual_cwd_globals parameter passed in via the destructor, the latter uses the CWDG() macro.

[DimitryAndric]

Alternative approach in 9d38056, but this required adding a ZEND_TSRMG_FAST_BULK macro to zend.h, and is somewhat more invasive. The end result looks a bit nicer, though.

[nikic]

I think this looks reasonable for now, though it's rather annoying that you can't use normal global access in globals_dtor, as it may get run from a different thread :/

[nikic]

Merged as 99a2085.

[DimitryAndric]

I think this looks reasonable for now, though it's rather annoying that you can't use normal global access in globals_dtor, as it may get run from a different thread :/

I guess this is because realpath_cache_clean() is an externally available function? I.e. it is called from ext/opcache/ZendAccelerator.c and ext/standard/filestat.c. These can have any random thread context, so then you'll have to use CWDG(), at least if I understand correctly. But there are probably historical reasons why this function exists. :)